Vulnerability Description
Calico's Application Layer Policy (disabled by default), which enforces HTTP rules through Dikastes, fails to perform URL path normalization. As a result, HTTP requests using path-traversal segments, encoded slashes, or repeated slashes are not correctly evaluated by Prefix path rules. Dikastes authorizes the request under the permitted prefix while the downstream workload or a fronting proxy normalizes the path and serves the restricted endpoint. An attacker with network access and no special RBAC can potentially reach HTTP endpoints the policy was intended to restrict.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Tigera | Calico | < 3.21.7 |
Related Weaknesses (CWE)
References
- https://github.com/projectcalico/calico/pull/12531Issue TrackingPatch
- https://github.com/projectcalico/calico/pull/12532Issue TrackingPatch
- https://github.com/projectcalico/calico/pull/12533Issue TrackingPatch
- https://www.tigera.io/security-bulletins/tta-2026-005/Vendor Advisory
FAQ
What is CVE-2026-6540?
CVE-2026-6540 is a vulnerability with a CVSS score of 7.5 (HIGH). Calico's Application Layer Policy (disabled by default), which enforces HTTP rules through Dikastes, fails to perform URL path normalization. As a result, HTTP requests using path-traversal segments, ...
How severe is CVE-2026-6540?
CVE-2026-6540 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-6540?
Check the references section above for vendor advisories and patch information. Affected products include: Tigera Calico.